The coordinated assault began at 6:30 a.m. at the Immaculate Saint Mary Catholic Church on Ngagel Madya Street, where two attackers on a motorcycle drove past the security checkpoint and detonated their explosives as the first mass was letting out. A security officer named Aloysius Bayu Rendra Wardhana tried to block them at the entrance. Five worshippers and two bombers were killed; the church's windows were blown out, though the main structure survived. An hour later, the attack on GKI Church on Diponegoro Street killed the three bombers but no civilians, largely because the security guard's intervention kept them outside. At 7:53, a Toyota Avanza rammed the gate of the Surabaya Central Pentecostal Church on Arjuno Street, destroying five cars and thirty motorcycles. Ten civilians died there along with the driver. Emergency services arrived within two minutes of the first blast.

The perpetrators were not lone operatives or hardened militants. They were families. The church bombings were carried out by Dita Oepriarto, his wife Puji Kuswati, and their four children, aged 18, 15, 12, and 9. Dita drove the car bomb into the Pentecostal church. Puji and her two daughters, wearing belt bombs strapped to their bodies, attacked the GKI Church. The two older sons rode the motorcycle into the Catholic church. Indonesian police confirmed it was the first time in the country's history that terrorists had deployed entire families, including young children, as suicide bombers. Later reports revealed that some of the children had resisted. Firman Halim, age 15, was seen crying the day before the attack. A security officer reported that all four children were weeping at the family's prayer hall the night before, suspected to have known they would not survive the morning.

The violence did not end on Sunday. That evening, a bomb detonated in an apartment complex in Sidoarjo, south of Surabaya, when a second family's explosives went off prematurely during a police raid, killing three adults. The next morning, a third family attacked the Surabaya Police Headquarters on motorcycles, killing four bombers and wounding ten others. An eight-year-old girl, believed to be the attackers' daughter, was found wandering among the bodies, screaming. Police identified all three families as members of Jamaah Ansharut Daulah (JAD), the Indonesian branch of ISIL. The group's leader, Aman Abdurrahman, had ordered the attacks from prison as retaliation for his continued imprisonment. In the weeks that followed, Detachment 88 -- Indonesia's elite counter-terrorism unit -- conducted raids across the archipelago, arresting 197 suspects and killing 20 in shootouts. Officers recovered a truckload of pipe bombs.

President Joko Widodo flew to Surabaya that day. He called the attacks "barbaric acts" and "a crime against humanity, unrelated with any religion," reserving particular condemnation for the use of children. He guaranteed government coverage of all victims' medical expenses and warned that if lawmakers could not finalize revised anti-terrorism legislation by June, he would issue an emergency decree. Indonesia's major Muslim organizations responded with a unified message of rejection. Nahdlatul Ulama's chairman declared that "there is not a single religion in the world that justifies violence as a way of life." Muhammadiyah dispatched personnel to help treat victims and declared that suicide bombings are not jihad. The Indonesian Red Cross reported 600 blood donations that day against a routine target of 400. The bombings accelerated passage of the long-stalled anti-terrorism law revision, which had been debated since 2016. In the aftermath, security was raised to its highest level across the Indonesian archipelago.